Privacy Notice

1. INTRODUCTION

YWO (MU) LTD (the “Company”) is incorporated and existing under the Laws of Mauritius with registration number 229766, and registered address Legacy Capital Co Ltd, 2 Floor, Suite 201, The Catalyst, Ebene, Republic of Mauritius.

The Company is an Investment Dealer (Full-Service Dealer, Excluding Underwriting) Licensee, regulated and authorized by the Financial Services Commission (“FSC”), Mauritius under the license number GB25205550.

This Privacy Notice explains how we collect, process, use, store, and protect your personal data. “Personal data” refers to any information relating to an identified or identifiable natural person, as defined under the Mauritius Data Protection Act 2017 (“DPA”).

The Company is committed to protecting your privacy and handling your Personal Information in a lawful, fair, secure, and transparent manner as required by the DPA.

2. COLLECTION OF PERSONAL INFORMATION

The Company collects Personal Information necessary for:

• Opening and maintaining your trading account
• Providing our investment and brokerage services
• Complying with our legal and regulatory obligations
• Safeguarding your assets and ensuring secure transactions

Personal Information is collected directly from you during onboarding, through your use of the Company’s website, trading platform, or mobile application, and from approved third-party service providers engaged for verification and fraud-prevention purposes. All Personal Information is collected lawfully, fairly, and transparently, in accordance with the DPA.

3. DATA COLLECTED

The categories of Personal Information the Company may collect and process include, but are not limited to:

a) Information you provide to us during onboarding or throughout the business relationship

• Identification documents (passport, national ID, driving licence)
• Proof of address
• Full name, contact details, date of birth, nationality
• Tax Identification Number
• Employment and financial information
• Bank account and payment details
• Source of Funds and Source of Wealth
• Transaction history (deposits, withdrawals, transfers)
• Application forms, declarations, and communication records

b) Information collected through your use of our website, trading platform, or mobile application

• IP address, device identifiers, and geolocation
• Browser type, device model, operating system
• Pages visited, clicks, scroll behaviour, and session information
• App usage data, installation date, and version
• Documents uploaded or downloaded
• Trading activity and interaction patterns

c) Information obtained from third-party verification and compliance tools

• Identity verification results
• AML/CFT screening data
• Fraud-prevention and risk-assessment information

4. PURPOSE OF COLLECTING PERSONAL INFORMATION

We collect and process your personal data according to the following lawful purposes:

a) Compliance with Legal Obligations

To comply with the DPA, Financial Intelligence and Anti-Money Laundering Act 2002 (“FIAMLA”), the FSC Rules, and all regulatory requirements. This includes verifying your identity, assessing your suitability, performing due diligence checks, monitoring your transactions, preventing fraud, and ensuring we meet our AML/CFT obligations.

b) Performance of a Contract

To provide you with investment and brokerage services, including:

• Maintaining and managing your trading account
• Processing transactions and providing support
• Personalising your experience based on your trading history and profile
• Communicating with you regarding your account or our services
• Ensuring compliance with our Terms & Conditions

c) Marketing

The Company may use your Personal Information to send you communications about:

• Products and services
• Promotions and offers
• Events or updates

We process Personal Information for marketing purposes only as necessary on the lawful basis and for the purpose of our legitimate interests in promoting our products and services to you. Should you wish to withdraw your consent or opt out you may do it at any time by contacting us at dpo@ywo.com. Please note that opting out from marketing services (i) might affect your ability to explore new products and services and their customization to your needs and requirements, and (ii) will not prevent completely all forms of communications to you, since the Company is required by law to communicate and inform you of legal aspects related to the products and services provided to you by the Company.

d) Legitimate Interests

We may process your Personal Information for purposes such as:

• Risk management
• Monitoring for abuse or misuse of services
• Diagnostics, research, and service improvement
• Profiling for client categorisation, risk assessment, and marketing (where lawful)
• Protecting our rights, property, and safety

All legitimate interest processing is balanced against your fundamental rights and freedoms.

5. AUTOMATED DECISION-MAKING AND PROFILING

The Company may, where appropriate and lawful, use automated processing techniques, including automated decision-making and profiling, to support its regulatory, operational, and risk-management obligations. Such automated systems may be used for the following purposes:

• identity verification and authentication procedures
• AML/CFT risk assessment, including transaction monitoring and customer risk scoring
• suitability and appropriateness assessments required under applicable financial services regulations
• fraud detection, prevention, and security monitoring
• customer segmentation and the provision of personalised marketing and service recommendations, where lawful

Where automated decision-making produces legal effects concerning you, or significantly affects you, such processing will only occur where it is:

• necessary for entering into, or performing, a contract between you and the Company
• authorised by a written law to which the Company is subject or
• carried out with your explicit consent

In cases where automated decision-making or profiling is used, you have the following rights under the DPA:

• the right to request human intervention in the decision-making process
• the right to obtain an explanation of the logic involved in the automated decision
• the right to express your point of view and contest the decision
• the right to request that the Company restrict or cease reliance on automated processing, subject to legal and regulatory constraints

The Company ensures that any automated processing is carried out in a manner that is lawful, transparent, proportionate, and consistent with its obligations under the DPA, the FSC’s regulatory framework, and internationally recognised data-protection standards.

Profiling for marketing purposes is carried out only where permitted by law and subject to your right to object at any time.

6. INTENDED RECIPIENTS OF THE DATA

The Company may disclose or grant access to Personal Data only where such disclosure is lawful, necessary, and proportionate, and strictly in accordance with the DPA, and applicable financial services legislation. Personal Data may be shared with the following categories of recipients:

• Employees and authorised personnel who require access for the performance of their duties
• Group companies or affiliates, where such access is necessary for operational, compliance, or support functions
• External service providers, including technology providers, cloud hosting providers, data-verification vendors, KYC/AML screening tools, or IT support providers, who process Personal Data on behalf of the Company
• Financial institutions, payment service providers, and banking partners involved in the execution of your transactions
• Identity, fraud-prevention, and AML/CFT verification agencies for purposes of regulatory compliance, risk management, and safeguarding the integrity of our services
• Professional advisors, including auditors, legal counsel, and consultants, engaged by the Company
• Regulatory authorities, where disclosure is required by law or regulation
• Law enforcement agencies or other competent authorities, where required pursuant to a legal obligation, court order, investigation, or statutory request

All third parties who receive or process Personal Data on behalf of the Company are required to comply with strict confidentiality, data-protection, and security standards equivalent to those set out in the DPA. Such processing is always governed by appropriate contractual agreements, including data-processing agreements or confidentiality undertakings, where applicable.

The Company does not sell, lease, trade, or otherwise monetise Personal Data under any circumstances.

7. RESTRICTION OF RESPONSIBILITY

The Company’s website, trading platform, and mobile applications may contain links to third-party websites, applications, or services. Such third-party platforms operate independently from the Company, and their own privacy notices, data-processing practices, and security standards apply. The Company has no control over, and accepts no responsibility for, the content, data-handling practices, or privacy policies of any third-party websites or services that you may access through such links.

Any personal data that you provide directly to third-party websites or that is collected by them is governed solely by their respective privacy notices. The Company shall not be held liable for any loss, damage, or misuse of personal data arising from your use of third-party sites or services.

Users are strongly encouraged to review the privacy notices and terms of use of any external websites or services prior to sharing personal information or engaging with their content.

8. GOOGLE ANALYTICS The Company may use Google Analytics, Google Ads Remarketing, and similar technologies to analyse website usage, improve user experience, and deliver relevant advertisements based on your past interactions with our website.

Third-party vendors, including Google, may display our advertisements across the internet using cookies or similar tracking technologies. These cookies enable the delivery of ads tailored to your interests and browsing behaviour.

You may opt out of Google’s advertising features at any time by adjusting your settings via:

• Google Ads Preferences Manager, or
• Google Analytics Opt-Out Browser Add-On.

For further details, you may consult Google’s Privacy Centre.

9. USE OF COOKIES

The Company uses cookies and similar technologies to enhance website functionality, improve performance, and provide a more personalised user experience. Cookies are small text files stored on your device when you access our website.

Cookies may be used for:

• authentication and security;
• remembering user preferences;
• improving website performance;
• analytics and usage tracking;
• enabling certain platform features.

Cookies do not contain your personal identification details, account credentials, or passwords.

You may disable cookies through your browser settings; however, some website features, including account registration, promotions, or secure areas, may not function properly if cookies are disabled.

The Company may also engage trusted third parties to analyse website traffic and usage patterns. These third parties may set cookies on our behalf, and such cookies will not contain personally identifiable information.

10. TRANSFER OF DATA TO THIRD COUNTRIES

Your Personal Information may be transferred to, stored in, or processed in jurisdictions outside the Republic of Mauritius, including countries where the Company’s affiliates, group entities, or external service providers are located.

Any such transfers are carried out strictly in accordance with the DPA and only where an adequate level of protection can be ensured. Transfers may rely on:

• an adequacy decision issued under the DPA or other recognised authority
• appropriate contractual safeguards, including data-processing or data-sharing agreements
• standard contractual clauses approved under the DPA or
• other lawful transfer mechanisms permitted by the DPA.

In all cases, the Company ensures that your Personal Information is afforded a standard of protection that is equivalent to that required under Mauritian law, including appropriate security, confidentiality, and data-handling measures.

11. MARKETING COMMUNICATION

Where you have provided your consent, the Company may send you marketing communications, which provides you with information regarding the products and services offered by the Company or its partners and opportunities that we believe may be relevant to you, newsletters, emails and SMS (text) messages, and other electronic communication. If you no longer wish to receive the above-mentioned types of communication, you may opt-out by following the instructions included in each message or by sending an email to dpo@ywo.com.

12. YOUR RIGHTS

You are not obliged to provide the Personal Information requested by the Company. However, without the information required in the application form or during our due diligence processes, the Company may be unable to open an account for you, provide you with the requested services, or assess the suitability and appropriateness of those services.

In accordance with the DPA you, as a data subject, have certain rights regarding the Personal Information that the Company holds about you. Some of these rights apply only in specific circumstances and may be subject to limitations or exemptions. Where such exemptions apply, the Company will inform you in its response.

a) Access to Personal Information:

You have the right to request confirmation as to whether the Company holds Personal Information about you, and to obtain access to such information, including a record or description of the Personal Information being processed.

b) Correction of Personal Information

You may request the Company to correct, update, or rectify any Personal Information that is inaccurate, incomplete, or outdated.

c) Right of Erasure

You may request the Company to erase your Personal Information where there is no lawful or compelling reason for its continued processing. This right applies only in the circumstances provided for under the DPA.

d) Right to object on reasonable grounds to the processing of Personal Information

You may object, on reasonable grounds relating to your particular situation, to the processing of your Personal Information. The Company may refuse such a request where the processing is required by law or is otherwise justified under the DPA. Where processing is restricted, the Company may continue to store your Personal Information but may only process it further with your consent or as permitted by law. Please note that restricting processing may affect the Company’s ability to provide services to you.

e) Right to object to processing of Personal Information for direct marketing You have the absolute right to object at any time to the processing of your Personal Information for direct marketing purposes. Once you object, the Company will cease such processing.

f) Rights in relation to automated decision-making and profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. This right does not apply where the automated decision-making is:

• necessary for entering into or performing a contract with you,
• authorised by law, or
• carried out with your explicit consent.

In such cases, you may request human intervention, seek an explanation of the decision, and contest the outcome.

g) Right to Complain

If you are dissatisfied with the manner in which your Personal Information has been handled, you may lodge a complaint at: support@ywo.com

Please provide sufficient information to identify yourself and to allow us to process your request. The Company will address your complaint as soon as reasonably practicable.

If you are not satisfied with the Company’s response, you have the right to lodge a complaint with the Data Protection Office of Mauritius:

Address: Level 5, SICOM Tower Wall Street, Ebene Cyber City, Ebene, Republic of Mauritius

Email Address: dpo@govmu.org

13. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice annually or earlier if regulatory changes or business needs require. Any material changes will be published on the Company’s website or communicated through other appropriate channels. The posting of an updated version on the Company’s website shall constitute valid and effective notice of such changes. Continued use of the Company’s website, platform, or services following the publication of an updated Privacy Notice shall be deemed acknowledgment and acceptance of the revised terms.